Barracuda Email Security Gateways Targeted by Critical Root-Level Vulnerabilities
Attackers are chaining two severe vulnerabilities to gain unauthorized root access on Barracuda devices.
1Critical Vulnerability Chain Identified
Barracuda has confirmed that attackers are actively exploiting two vulnerabilities in its Email Security Gateway products. By chaining a pre-authentication authorization bypass with a command-injection flaw, intruders can execute commands with root privileges. This combination allows unauthorized actors to potentially gain full control over affected enterprise email security systems.
2Specific Flaws and CVSS Ratings
The vulnerabilities are tracked as CVE-2026-116606 and CVE-2026-111560. The first, a pre-authentication bypass, carries a high 9.3 CVSS score, while the command-injection flaw is rated at 8.6. These flaws allow attackers to bypass security controls without needing valid credentials, provided they have access to the administrative user interface.
3Broad Impact Across Product Lines
While the authorization bypass specifically impacts the Email Security Gateway, the command-injection flaw affects a wider range of Barracuda hardware. This includes load balancers, message archivers, web application firewalls, and web security gateways. Organizations utilizing these edge devices are urged to verify their exposure and apply the vendor-provided patches immediately.
4Active Exploitation and Response
Barracuda reported that a small number of organizations have already been targeted by these exploits. The company stated it has worked directly with affected businesses to remediate the issues. Despite inquiries regarding the exact number of compromised entities, the vendor declined to provide specific figures, focusing instead on the patch deployment.
5Security Recommendations for Administrators
Security experts advise that any administrative interface exposed to the public internet should be restricted immediately. Closing access to the admin UI serves as a critical defensive measure while patches are being applied. Organizations must prioritize these updates to prevent attackers from installing backdoors or exfiltrating sensitive corporate email data.
6Historical Context of Attacks
This incident follows a pattern of edge-device targeting previously observed in the cybersecurity landscape. In 2023, the FBI attributed similar attacks on Barracuda gateways to state-linked actors. These campaigns often aimed to deploy custom malware, with government entities frequently identified as primary targets for long-term network persistence and espionage activities.
7Potential Risks of Root Access
If attackers successfully achieve root access, the consequences for an organization are severe. Intruders can steal confidential data, install persistent backdoors, and manipulate system configurations to hide their presence. Full control over a security gateway effectively turns a defensive tool into a potential entry point for deeper network lateral movement.
8Urgency of Patching Protocols
The combination of high-severity scores and evidence of active exploitation necessitates immediate action from IT departments. Organizations should verify their current firmware versions against the latest security advisories released by Barracuda. Failure to patch these specific vulnerabilities leaves infrastructure exposed to sophisticated actors capable of exploiting these known security gaps.